开发者

tcpdump stateful filtering

Consider I have two hosts A and B. They both have a webserver on port 80. Both servers download files from each other through their webservers. A:some_port <--> b:80 and at the same time A:80 <--> B:some_port.

How can I run a tcpdump to capture all packets whose client is either host A, or B? I do not want to have a mixed up dump file including packets from both connections.

if I use开发者_如何学C:

tcpdump -i eth0 host A and port 80

I receive all packets between A and B. And if I change it to

tcpdump -i eth0 src host A and src port 80

then I just received wrong half the packets.

Do you have any suggestions?


I couldn't find any way to do that. Yet, what I did was to use different source port ranges for different connections and use them in my tcpdump filter...

tcpdump -i eth0 -nn portrange $dumpPortListenRange1
tcpdump -i eth0 -nn portrange $dumpPortListenRange2

I know it is not the answer, but it is tweak to make it work...

0

上一篇:

下一篇:

精彩评论

暂无评论...
验证码 换一张
取 消

最新问答

问答排行榜